Paste lines from your nginx error log, or drop the whole error.log file, and this analyzer groups repeated errors together, ranks them by severity and frequency, and explains each one in plain English with the setting or command to fix it. It recognizes more than 40 common nginx problems, including 502 Bad Gateway and 504 Gateway Timeout causes, PHP-FPM errors, permission problems, upload limits, rate limiting, and TLS handshake failures. Rotated .gz logs open directly, and nothing leaves your browser, so logs with IP addresses and URLs stay private.
How to analyze an nginx error log
- Copy lines from your error log, usually
/var/log/nginx/error.log, and paste them on the left. Or click Open log file to load the whole file, including rotated files likeerror.log.1anderror.log.2.gz. - Read the Problems tab. Each card is one kind of error, with how many times it happened, an example, the requests and clients involved, and what to do about it.
- Click Show these entries to see every occurrence, or use the Entries tab to search by IP address, URL, or text and filter by level.
- Check Overview for a timeline of errors and warnings and the top clients, URLs, upstreams, and hosts. Click any of them to see their entries.
- Download the entries as CSV or JSON to share them or load them into a spreadsheet.
To grab recent lines on the server, run sudo tail -n 2000 /var/log/nginx/error.log, or sudo grep "$(date +%Y/%m/%d)" /var/log/nginx/error.log for today only. If you don't know where the log is, nginx -T | grep error_log shows the configured path.
Common nginx errors and what they mean
| Log message | What visitors see | Usual cause |
|---|---|---|
connect() failed (111: Connection refused) while connecting to upstream | 502 Bad Gateway | The app server or PHP-FPM isn't running or isn't listening on that port |
connect() to unix:/run/php/php-fpm.sock failed (2: No such file or directory) | 502 Bad Gateway | PHP-FPM is stopped, or the socket path changed after a PHP upgrade |
upstream timed out (110: Connection timed out) while reading response header | 504 Gateway Timeout | The backend took longer than proxy_read_timeout or fastcgi_read_timeout |
upstream prematurely closed connection | 502 Bad Gateway | The backend crashed or was killed mid-request |
upstream sent too big header | 502 Bad Gateway | Large cookies or headers. Raise proxy_buffer_size or fastcgi_buffer_size |
open() "..." failed (2: No such file or directory) | 404 Not Found | A missing file, an old link, or a bot probing for common paths |
(13: Permission denied) | 403 Forbidden | The nginx user can't read the file or a folder above it |
directory index of "..." is forbidden | 403 Forbidden | No index file in the folder and listings are off |
FastCGI sent in stderr: "Primary script unknown" | 404 or "File not found." | Wrong SCRIPT_FILENAME or root for PHP |
client intended to send too large body | 413 Request Entity Too Large | Upload bigger than client_max_body_size, which defaults to 1 MB |
limiting requests, excess | 503 (or 429 if configured) | A client exceeded your limit_req rate |
rewrite or internal redirection cycle | 500 Internal Server Error | A try_files or rewrite rule that loops back on itself |
Reading an nginx error log line
Every entry follows the same pattern:
2026/10/06 08:02:01 [error] 1234#1234: *15 connect() failed (111: Connection refused) while connecting to upstream, client: 203.0.113.9, server: api.example.com, request: "POST /v1/orders HTTP/2.0", upstream: "http://127.0.0.1:3000/v1/orders", host: "api.example.com"
That's the date and time in the server's local time zone, the level, the worker process and thread IDs, the connection number (*15), the message itself, and context about the request: the visitor's IP address, the server_name that handled it, the request line, the backend it was sent to, and the Host header. Lines that don't start with a date, like PHP stack traces, belong to the entry above them, and the analyzer joins them back together.
The levels from most to least severe are emerg, alert, crit, error, warn, notice, info, and debug. The error_log directive sets the lowest level that gets written, for example error_log /var/log/nginx/error.log warn;.
Frequently asked questions
Where is the nginx error log?
On most Linux systems it is /var/log/nginx/error.log. Some setups write a separate error log per site, set with the error_log directive inside a server block. Run nginx -T | grep error_log to see every path in your configuration. In Docker, nginx usually logs to the container's output, so use docker logs.
How do I fix 502 Bad Gateway in nginx?
Look for the matching error log entry. "Connection refused" or a missing socket means the backend isn't running, so start or restart it. "Upstream prematurely closed connection" means it crashed, so check its own logs. "Upstream sent too big header" means you need larger proxy or fastcgi buffers. Paste the log here and the Problems tab shows which one you have.
How do I fix 504 Gateway Timeout in nginx?
The log will say "upstream timed out (110: Connection timed out) while reading response header from upstream". The backend took longer than the timeout, 60 seconds by default. Find out why the requests listed are slow, or raise proxy_read_timeout (or fastcgi_read_timeout for PHP) if the work genuinely takes longer.
Can it read the access log too?
No, this tool reads the error log. If you paste access log lines it will tell you. The access log records every request, while the error log records what went wrong and why, which is what you need for troubleshooting.
Can I open a compressed .gz log?
Yes. Rotated logs like error.log.2.gz are decompressed in your browser. Very large logs are analyzed in full but not displayed in the text box, to keep the page fast.
Is my log uploaded anywhere?
No. Logs contain IP addresses, URLs, and sometimes tokens in query strings, so everything is processed in your browser and never sent to a server.